@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
jpg619/fix-accessibility-content-flow
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 36 lines 2.01 KB
Raw
1 ---
2 title: Reporting malware in an npm package
3 redirect_from:
4 - /reporting-a-vulnerability-in-an-npm-package
5 ---
6
7 If you find malware in an npm package (either yours or someone else's), you can report it to the npm Security team to help keep the JavaScript ecosystem safe.
8
9 <Note>
10
11 **Note:** Vulnerabilities in npm packages should be reported directly to the package maintainers. We strongly advise doing this privately. You can find contact information about package maintainers with `npm owner ls <package-name>`. If the source code is hosted on GitHub please refer to the repository's [Security Policy](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository#about-security-policies).
12
13 </Note>
14
15 ## How npm Security handles malware
16
17 Malware is a major concern for npm Security and we have removed hundreds of malicious packages from the registry. For every malware report we receive, npm Security takes the following actions:
18
19 1. Confirm validity of the report.
20 2. Remove the package from the registry.
21 3. Publish a security placeholder for the package.
22 4. Publish a security advisory alerting the community.
23
24 As part of our process we determine whether the user account who uploaded the package should be banned. We also cooperate with 3rd parties when applicable.
25
26 ## Reporting malware
27
28 1. Gather information about the malware.
29 2. On the package page, click **Report malware**.
30 3. On the malware report page, provide information about yourself and the malware:
31 - **Name:** Your name.
32 - **Email address:** An email address the npm Security team can use to contact you.
33 - **Package name:** The name of the package that contains the malware.
34 - **Package version:** The version of the package that contains the malware. Include all affected versions.
35 - **Description of the malware:** A brief description of the malware and its effects. Include references, commits, and/or code examples that would help our researchers confirm the report.
36 4. Click **Send Report**.